memoQ serversecurity overview

SECURITY IS AN INCREASINGLY IMPORTANT TOPIC WHEN COMPANIESINVEST INTO SOFTWARE. WE AT MEMOQ REALIZE THIS, AND CREATED THIS
BROCHURE TO PROVIDE INFORMATION ABOUT THE SECURITY OF OURFLAGSHIP PRODUCT, MEMOQ SERVER.
For more help or troubleshooting, please visit our online documentation:
https://helpcenter.memoq.com© memoQ Ltd. 2019

—Data Protection

—Data at rest
memoQ server’s file system leverages Windows security features. memoQ server runs
as a dedicated Windows service with exclusive access rights. For on-premise and hosted
deployments, BitLocker can be enabled. On Azure-based cloud and hosted deployments,
storage is encrypted by Azure. On cloud deployments, the whole VM (containing multiplecloud instances) is encrypted with the same key. On hosted deployments, file systems ofeach memoQ server are encrypted with a separate key.

File system
memoQ server’s file system leverages Windows security features. memoQ server runs
as a dedicated Windows service with exclusive access rights. For on-premise and hosted
deployments, BitLocker can be enabled. On Azure-based cloud and hosted deployments,
storage is encrypted by Azure. On cloud deployments, the whole VM (containing multiplecloud instances) is encrypted with the same key. On hosted deployments, file systems ofeach memoQ server are encrypted with a separate key.

Data Protection - Data at rest | 4

SQL Server
The SQL server used by memoQ server operates according to SQL Server security bestpractices. It runs under a dedicated service account, without public access permissions.

Backup process
For cloud and hosted deployments, memoQ Ltd. conducts daily backups. On hosted servers,
files from the last seven daily backups are stored on the memoQ server, and a copy ofthese backup files is also copied to a globally redundant, encrypted remote Azure backup
storage. On cloud servers, backups are stored in a globally redundant, encrypted remote
Azure backup storage.

Data Protection - Data at rest | 5

—Data Separation
On-premise deployments
memoQ server operates on the customer’s premises. Data separation can be configured asneeded.

HostedEach hosted memoQ server runs on a dedicated virtual machine.

CloudmemoQ cloud is a multi-tenant environment, multiple memoQ servers are running in one
virtual machine.
File system data separation: Each memoQ server runs under a separate user account.
Permissions limit access to customer’s own data.
SQL Server data separation: Each memoQ server has a separate database within the same
SQL Server. Permissions limit access to customer’s own data.

Data Protection - Data at rest | 6

—Data Transfer
During memoQ server’s operation, data moves between four actors:• memoQ server• memoQ client (the desktop app)• memoQWeb• Data stores (file system, SQL Server)
Metadata also moves between memoQ server and memoQ Ltd.’s company infrastructure(such as Activator service, Update server or Crash reporting).
memoQ server, memoQWeb’s backend (IIS application pools), and the Data stores are allwithin the hosting environment - that is, behind a firewall.
All communication can be configured as secured (in most cases, HTTPS), with a few
exceptions. All of these exceptions are under control by other means, and within thehosting environment:• File store access (SMB protocol)• Active Directory• Custom code execution - file access permissions need to be set up manually every
time by the memoQ server’s system admin• WordPress Connector• Preview SDK - accepts only local calls, not remote ones
• Activation - RSA public/private key encryption is used in internal protocol• Content connector’s File system connections (SMB protocol)

Data Protection - Data at rest | 7

—Authentication and Authorization
memoQ server handles authentication and authorization in multiple ways:• Username and password: The memoQ server’s system admin can control password
complexity and password history via the Deployment tool.
• Active Directory integration: memoQ server delegates authentication to AD. Thissolution works only when the memoQ server and the Active Directory server are within
the same network and Windows domain - that is, only in on-premise deployments.
• Permission system: memoQ administrators and project managers can control accessto projects, resources, and memoQ functionalities via group memberships or individualpermissions.
• An OpenID Connect-based single sign-on (SSO) solution is on our roadmap.

Data Protection - Data at rest | 8

—System Integrity

—Web services security
Our security guidelines follow OWASP TOP10.
memoQ’s continuous integration (CI) system checks for vulnerabilities.

—Non-web security
User interface
The memoQ client’s UI is based on Windows Forms (WF) and Windows Presentation Foundation(WPF). Input fields are validated: users cannot enter executable code or parts thereofs.

APIs
memoQ has standard SOAP and REST APIs that can be configured to use HTTPS. Input isvalidated. Token-based authentication is used.

Data import
Human control (2 reviewers) over possible issue with Microsoft Excel files where malicious
executable code can be entered into translation.
Antivirus software can be installed on memoQ server to check imported/exported files.

Data Protection - Data at rest | 10

—Software Development
Lifecycle—Code integrity
Our security guidelines follow OWASP TOP10.
memoQ’s continuous integration (CI) system checks for vulnerabilities.

—

Code reviews
All code changes undergo mandatory informal code reviews..

—

QA
All releases go through a QA procedure.

Data Protection - Data at rest | 12

—Release controlPermission system defines who is entitled to release and when.

—

Penetration tests
On request, memoQ Ltd. arranges a trial hosted memoQ server setup for customers whoorganize penetration tests for themselves.

—ISO certification
Software development and cloud services at memoQ are ISO 27001 certified by TÜVSÜD - making sure that the entire process of producing the software, and operating
cloud infrastructure for customers are part of a standardized framework that places highimportance on security concerns.

Data Protection - Data at rest | 13

—About memoQ
memoQ Translation Technologies is the developer of memoQ, one of the world’s mostadvanced translation environments. Used by hundreds of enterprises and translationcompanies all over the world, memoQ is the #1 solution to automate and optimize theentire localization process, and manage translation and localization projects in a time andcost-efficient manner.

—Contact us
Do you have any other questions or concerns regarding a CAT tool, a TMS, integrations
or else?
Get in touch with us at sales@memoq.com